Agile protocol for secure communications with assured system availability

Abstract

A method of transmitting data over a computer network includes, at an originating terminal connected to the computer network, receiving a stream of data and inserting a first level packet payload containing an at least one dummy data. The method includes, identifying a network destination address for the stream of data. Further, the method includes, forming a first level packet including the first level packet payload and a first level header containing data representing the network destination address. The method further includes, encrypting at least a portion of the first level packet to form a second level packet payload. The method further includes, forming a second level packet including the second level packet payload and a second layer header containing a router address of an intermediate router connecting the originating terminal to the network destination address. The method further includes, sending the second level packet to the intermediate router at the router address.

1 .- 5 . (canceled) 
     
     
         6 . A method for transmitting data over a computer network, comprising the steps of:
 at an originating terminal connected to the computer network, receiving a stream of data and inserting a first level packet payload containing at least one dummy data;   identifying a network destination address for the stream of data;   forming a first level packet including the first level packet payload and a first level header containing data representing the network destination address;   encrypting at least a portion of the first level packet to form a second level packet payload;   forming a second level packet including the second level packet payload and a second layer header containing a router address of an intermediate router connecting the originating terminal to the network destination address;   sending the second level packet to the intermediate router at the router address.   
     
     
         7 . The method of  claim 6 , wherein inserting the first level packet payload containing the at least one dummy data is determined by an algorithm. 
     
     
         8 . The method of  claim 7 , wherein the algorithm is based on the stream of data, a time of day, or a detection of network traffic. 
     
     
         9 . The method of  claim 7 , wherein the algorithm is responsive to a time of day or a detection of traffic. 
     
     
         10 . The method of  claim 6 , further comprising including in one of the first and second layer headers, a perishable indicator. 
     
     
         11 . The method of  claim 10 , wherein the intermediate router, determines, based on the perishable indicator, whether to forward the second level packet to another intermediate router at another router. 
     
     
         12 . The method of  claim 10 , further comprising:
 decrypting the second level packet payload;   determining that the first level packet contains the at least one dummy data; and   incrementing the perishable indicator.   
     
     
         13 . The method of  claim 6 , further comprising determining the intermediate router by randomly selecting from a group of intermediate routers. 
     
     
         14 . The method of  claim 6 , further comprising, including in one of the first and second layer headers, an indicator of a number of hops to be made by the first level packet before arriving at the network destination address; and 
     
     
         15 . The method of  claim 14 , wherein the intermediate router, determines, based on the indicator of a number of hops, whether to forward the second level packet to another intermediate router at another router. 
     
     
         16 . The method of  claim 14 , wherein the intermediate router decrements the indicator of a number of hops and sends the first level packet to another intermediate router responsive to a value of the indicator of a number of hops. 
     
     
         17 . The method of  claim 6 , further comprising:
 decrypting the second level packet payload;   determining from the first level header the network destination address;   forming a new packet containing at least the first level packet payload; and   attaching a header to the new packet containing the network destination address, whereby a true destination of the data stream is concealed behind a layer of encryption for at least a portion of its travel over the network.   
     
     
         18 . The method of  claim 17 , wherein the step of determining from the first level header the network destination address includes converting the data representing the network destination address to the network destination address using correlation data stored on the intermediate router. 
     
     
         19 . An originating terminal connected to the computer network for transmitting data over a computer network, the system comprising:
 a storage device that stores a set of instructions; and   at least one processor that executes the set of instructions, the set of instructions causing the at least one processor to perform operations comprising:   receiving a stream of data and inserting a first level packet payload containing at least one dummy data;   identifying a network destination address for the stream of data;   forming a first level packet including the first level packet payload and a first level header containing data representing the network destination address;   encrypting at least a portion of the first level packet to form a second level packet payload;   forming a second level packet including the second level packet payload and a second layer header containing a router address of an intermediate router connecting the originating terminal to the network destination address;   sending the second level packet to the intermediate router at the router address.   
     
     
         20 . The originating terminal connected to the computer network of  claim 19 , wherein inserting the first level packet payload containing the at least one dummy data is determined by an algorithm. 
     
     
         21 . The originating terminal connected to the computer network of  claim 20 , wherein the algorithm is based on the stream of data, a time of day, or a detection of network traffic. 
     
     
         22 . The originating terminal connected to the computer network of  claim 20 , wherein the algorithm is responsive to a time of day or a detection of traffic. 
     
     
         23 . The originating terminal connected to the computer network of  claim 19 , wherein the set of instructions further cause the at least one processor to perform operations comprising including in one of the first and second layer headers, a perishable indicator. 
     
     
         24 . The originating terminal connected to the computer network of  claim 23 , wherein the intermediate router, determines, based on the perishable indicator, whether to forward the second level packet to another intermediate router at another router. 
     
     
         25 . The originating terminal connected to the computer network of  claim 23 , wherein the set of instructions further cause the at least one processor to perform operations comprising:
 decrypting the second level packet payload;   determining that the first level packet contains the at least one dummy data; and   incrementing the perishable indicator.   
     
     
         26 . The originating terminal connected to the computer network of  claim 19 , wherein the set of instructions further cause the at least one processor to perform operations comprising determining the intermediate router by randomly selecting from a group of intermediate routers. 
     
     
         27 . The originating terminal connected to the computer network of  claim 19 , wherein the set of instructions further cause the at least one processor to perform operations comprising including in one of the first and second layer headers, an indicator of a number of hops to be made by the first level packet before arriving at the network destination address; and 
     
     
         28 . The originating terminal connected to the computer network of  claim 27 , wherein the intermediate router, determines, based on the indicator of a number of hops, whether to forward the second level packet to another intermediate router at another router. 
     
     
         29 . The originating terminal connected to the computer network of  claim 27 , wherein the intermediate router decrements the indicator of a number of hops and sends the first level packet to another intermediate router responsive to a value of the indicator of a number of hops. 
     
     
         30 . The originating terminal connected to the computer network of  claim 19 , wherein the set of instructions further cause the at least one processor to perform operations comprising:
 decrypting the second level packet payload;   determining from the first level header the network destination address;   forming a new packet containing at least the first level packet payload; and   attaching a header to the new packet containing the network destination address, whereby a true destination of the data stream is concealed behind a layer of encryption for at least a portion of its travel over the network.   
     
     
         31 . The originating terminal connected to the computer network of  claim 30 , wherein to determine from the first level header the network destination address includes converting the data representing the network destination address to the network destination address using correlation data stored on the intermediate router.